Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj...

Transcript of Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj...

$Page 1: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic$

Addition laws on elliptic curves

D. J. Bernstein

University of Illinois at Chicago

Joint work with:

Tanja Lange

Technische Universiteit Eindhoven

2007.01.10, 09:00 (yikes!),

Leiden University, part of

“Mathematics: Algorithms and

Proofs” week at Lorentz Center:

Harold Edwards speaks on

“Addition on elliptic curves.”

Edwards

D. J. Bernstein

Joint work with:

Tanja Lange

2007.01.10, 09:00 (yikes!),

Edwards

What we think when we hear

“addition on elliptic curves”:

�P�Q�

�P + Qjjjjjjjjjjjjjjjjjjj

y

x

OO

//

II

Addition on y2 � 5xy = x3 � 7.

D. J. Bernstein

Joint work with:

Tanja Lange

2007.01.10, 09:00 (yikes!),

Edwards

�P�Q�

y

x

OO

//

II

D. J. Bernstein

Joint work with:

Tanja Lange

2007.01.10, 09:00 (yikes!),

Edwards

�P�Q�

y

x

OO

//

II

2007.01.10, 09:00 (yikes!),

Edwards

�P�Q�

y

x

OO

//

II

2007.01.10, 09:00 (yikes!),

Edwards

�P�Q�

y

x

OO

//

II

� = (y2 � y1)=(x2 � x1),

x3 = �2 � 5�� x1 � x2,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x2; y2) = (x3; y3).

2007.01.10, 09:00 (yikes!),

Edwards

�P�Q�

y

x

OO

//

II

� = (y2 � y1)=(x2 � x1),

x3 = �2 � 5�� x1 � x2,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x2; y2) = (x3; y3).

2007.01.10, 09:00 (yikes!),

Edwards

�P�Q�

y

x

OO

//

II

� = (y2 � y1)=(x2 � x1),

x3 = �2 � 5�� x1 � x2,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x2; y2) = (x3; y3).

�P�Q�

y

x

OO

//

II

� = (y2 � y1)=(x2 � x1),

x3 = �2 � 5�� x1 � x2,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x2; y2) = (x3; y3).

�P�Q�

y

x

OO

//

II

� = (y2 � y1)=(x2 � x1),

x3 = �2 � 5�� x1 � x2,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x2; y2) = (x3; y3).

Oops, this requires x1 6= x2.

� = (5y1 + 3x21)=(2y1 � 5x1),

x3 = �2 � 5�� 2x1,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x1; y1) = (x3; y3).

�P�Q�

y

x

OO

//

II

� = (y2 � y1)=(x2 � x1),

x3 = �2 � 5�� x1 � x2,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x2; y2) = (x3; y3).

� = (5y1 + 3x21)=(2y1 � 5x1),

x3 = �2 � 5�� 2x1,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x1; y1) = (x3; y3).

Oops, this requires 2y1 6= 5x1.

(x1; y1) + (x1; 5x1 � y1) = 1.

(x1; y1) +1 = (x1; y1).

1+ (x1; y1) = (x1; y1).

1+1 = 1.

�P�Q�

y

x

OO

//

II

� = (y2 � y1)=(x2 � x1),

x3 = �2 � 5�� x1 � x2,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x2; y2) = (x3; y3).

� = (5y1 + 3x21)=(2y1 � 5x1),

x3 = �2 � 5�� 2x1,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x1; y1) = (x3; y3).

(x1; y1) + (x1; 5x1 � y1) = 1.

(x1; y1) +1 = (x1; y1).

1+ (x1; y1) = (x1; y1).

1+1 = 1.

Despite 09:00,

despite Dutch trains,

we attend the talk.

Edwards says:

Euler–Gauss addition law

on x2 + y2 = 1� x2y2 is

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1� x1x2y1y2,

y3 =y1y2 � x1x2

1 + x1x2y1y2.

Euler Gauss

�P�Q�

y

x

OO

//

II

� = (y2 � y1)=(x2 � x1),

x3 = �2 � 5�� x1 � x2,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x2; y2) = (x3; y3).

� = (5y1 + 3x21)=(2y1 � 5x1),

x3 = �2 � 5�� 2x1,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x1; y1) = (x3; y3).

(x1; y1) + (x1; 5x1 � y1) = 1.

(x1; y1) +1 = (x1; y1).

1+ (x1; y1) = (x1; y1).

1+1 = 1.

Despite 09:00,

we attend the talk.

Edwards says:

on x2 + y2 = 1� x2y2 is

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1� x1x2y1y2,

y3 =y1y2 � x1x2

1 + x1x2y1y2.

Euler Gauss

�P�Q�

y

x

OO

//

II

� = (y2 � y1)=(x2 � x1),

x3 = �2 � 5�� x1 � x2,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x2; y2) = (x3; y3).

� = (5y1 + 3x21)=(2y1 � 5x1),

x3 = �2 � 5�� 2x1,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x1; y1) = (x3; y3).

(x1; y1) + (x1; 5x1 � y1) = 1.

(x1; y1) +1 = (x1; y1).

1+ (x1; y1) = (x1; y1).

1+1 = 1.

Despite 09:00,

we attend the talk.

Edwards says:

on x2 + y2 = 1� x2y2 is

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1� x1x2y1y2,

y3 =y1y2 � x1x2

1 + x1x2y1y2.

Euler Gauss

� = (y2 � y1)=(x2 � x1),

x3 = �2 � 5�� x1 � x2,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x2; y2) = (x3; y3).

� = (5y1 + 3x21)=(2y1 � 5x1),

x3 = �2 � 5�� 2x1,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x1; y1) = (x3; y3).

(x1; y1) + (x1; 5x1 � y1) = 1.

(x1; y1) +1 = (x1; y1).

1+ (x1; y1) = (x1; y1).

1+1 = 1.

Despite 09:00,

we attend the talk.

Edwards says:

on x2 + y2 = 1� x2y2 is

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1� x1x2y1y2,

y3 =y1y2 � x1x2

1 + x1x2y1y2.

Euler Gauss

� = (y2 � y1)=(x2 � x1),

x3 = �2 � 5�� x1 � x2,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x2; y2) = (x3; y3).

� = (5y1 + 3x21)=(2y1 � 5x1),

x3 = �2 � 5�� 2x1,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x1; y1) = (x3; y3).

(x1; y1) + (x1; 5x1 � y1) = 1.

(x1; y1) +1 = (x1; y1).

1+ (x1; y1) = (x1; y1).

1+1 = 1.

Despite 09:00,

we attend the talk.

Edwards says:

on x2 + y2 = 1� x2y2 is

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1� x1x2y1y2,

y3 =y1y2 � x1x2

1 + x1x2y1y2.

Euler Gauss

Edwards, continued:

Every elliptic curve over Q

is birationally equivalent to

x2 + y2 = a2(1 + x2y2)

for some a 2 Q� f0;�1;�ig.(Euler–Gauss curve � the

“lemniscatic elliptic curve.”)

� = (y2 � y1)=(x2 � x1),

x3 = �2 � 5�� x1 � x2,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x2; y2) = (x3; y3).

� = (5y1 + 3x21)=(2y1 � 5x1),

x3 = �2 � 5�� 2x1,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x1; y1) = (x3; y3).

(x1; y1) + (x1; 5x1 � y1) = 1.

(x1; y1) +1 = (x1; y1).

1+ (x1; y1) = (x1; y1).

1+1 = 1.

Despite 09:00,

we attend the talk.

Edwards says:

on x2 + y2 = 1� x2y2 is

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1� x1x2y1y2,

y3 =y1y2 � x1x2

1 + x1x2y1y2.

Euler Gauss

Edwards, continued:

x2 + y2 = a2(1 + x2y2)

� = (y2 � y1)=(x2 � x1),

x3 = �2 � 5�� x1 � x2,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x2; y2) = (x3; y3).

� = (5y1 + 3x21)=(2y1 � 5x1),

x3 = �2 � 5�� 2x1,

y3 = 5x3 � (y1 + �(x3 � x1))

) (x1; y1) + (x1; y1) = (x3; y3).

(x1; y1) + (x1; 5x1 � y1) = 1.

(x1; y1) +1 = (x1; y1).

1+ (x1; y1) = (x1; y1).

1+1 = 1.

Despite 09:00,

we attend the talk.

Edwards says:

on x2 + y2 = 1� x2y2 is

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1� x1x2y1y2,

y3 =y1y2 � x1x2

1 + x1x2y1y2.

Euler Gauss

Edwards, continued:

x2 + y2 = a2(1 + x2y2)

Despite 09:00,

we attend the talk.

Edwards says:

on x2 + y2 = 1� x2y2 is

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1� x1x2y1y2,

y3 =y1y2 � x1x2

1 + x1x2y1y2.

Euler Gauss

Edwards, continued:

x2 + y2 = a2(1 + x2y2)

Despite 09:00,

we attend the talk.

Edwards says:

on x2 + y2 = 1� x2y2 is

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1� x1x2y1y2,

y3 =y1y2 � x1x2

1 + x1x2y1y2.

Euler Gauss

Edwards, continued:

x2 + y2 = a2(1 + x2y2)

x2 + y2 = a2(1 + x2y2) has

neutral element (0; a), addition

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

a(1 + x1x2y1y2),

y3 =y1y2 � x1x2

a(1� x1x2y1y2).

Despite 09:00,

we attend the talk.

Edwards says:

on x2 + y2 = 1� x2y2 is

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1� x1x2y1y2,

y3 =y1y2 � x1x2

1 + x1x2y1y2.

Euler Gauss

Edwards, continued:

x2 + y2 = a2(1 + x2y2)

x2 + y2 = a2(1 + x2y2) has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

a(1 + x1x2y1y2),

y3 =y1y2 � x1x2

a(1� x1x2y1y2).

Addition law is “unified”:

(x1; y1) + (x1; y1) = (x3; y3) with

x3 =x1y1 + y1x1

a(1 + x1x1y1y1),

y3 =y1y1 � x1x1

a(1� x1x1y1y1).

Have seen unification before.

e.g., 1986 Chudnovsky2:

17M unified addition formulas

for (S : C : D : Z) on Jacobi’s

S2 + C2 = Z2, k2S2 + D2 = Z2.

Despite 09:00,

we attend the talk.

Edwards says:

on x2 + y2 = 1� x2y2 is

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1� x1x2y1y2,

y3 =y1y2 � x1x2

1 + x1x2y1y2.

Euler Gauss

Edwards, continued:

x2 + y2 = a2(1 + x2y2)

x2 + y2 = a2(1 + x2y2) has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

a(1 + x1x2y1y2),

y3 =y1y2 � x1x2

a(1� x1x2y1y2).

(x1; y1) + (x1; y1) = (x3; y3) with

x3 =x1y1 + y1x1

a(1 + x1x1y1y1),

y3 =y1y1 � x1x1

a(1� x1x1y1y1).

S2 + C2 = Z2, k2S2 + D2 = Z2.

Despite 09:00,

we attend the talk.

Edwards says:

on x2 + y2 = 1� x2y2 is

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1� x1x2y1y2,

y3 =y1y2 � x1x2

1 + x1x2y1y2.

Euler Gauss

Edwards, continued:

x2 + y2 = a2(1 + x2y2)

x2 + y2 = a2(1 + x2y2) has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

a(1 + x1x2y1y2),

y3 =y1y2 � x1x2

a(1� x1x2y1y2).

(x1; y1) + (x1; y1) = (x3; y3) with

x3 =x1y1 + y1x1

a(1 + x1x1y1y1),

y3 =y1y1 � x1x1

a(1� x1x1y1y1).

S2 + C2 = Z2, k2S2 + D2 = Z2.

Edwards, continued:

x2 + y2 = a2(1 + x2y2)

x2 + y2 = a2(1 + x2y2) has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

a(1 + x1x2y1y2),

y3 =y1y2 � x1x2

a(1� x1x2y1y2).

(x1; y1) + (x1; y1) = (x3; y3) with

x3 =x1y1 + y1x1

a(1 + x1x1y1y1),

y3 =y1y1 � x1x1

a(1� x1x1y1y1).

S2 + C2 = Z2, k2S2 + D2 = Z2.

Edwards, continued:

x2 + y2 = a2(1 + x2y2)

x2 + y2 = a2(1 + x2y2) has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

a(1 + x1x2y1y2),

y3 =y1y2 � x1x2

a(1� x1x2y1y2).

(x1; y1) + (x1; y1) = (x3; y3) with

x3 =x1y1 + y1x1

a(1 + x1x1y1y1),

y3 =y1y1 � x1x1

a(1� x1x1y1y1).

S2 + C2 = Z2, k2S2 + D2 = Z2.

2007.01.10, � 09:30,

Bernstein–Lange:

Edwards addition law with

standard projective (X : Y : Z),

standard Karatsuba optimization,

common-subexp elimination:

10M + 1S + 1A.

Faster than anything seen before!

M: field multiplication.

S: field squaring.

A: multiplication by a.

Karatsuba

Edwards, continued:

x2 + y2 = a2(1 + x2y2)

x2 + y2 = a2(1 + x2y2) has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

a(1 + x1x2y1y2),

y3 =y1y2 � x1x2

a(1� x1x2y1y2).

(x1; y1) + (x1; y1) = (x3; y3) with

x3 =x1y1 + y1x1

a(1 + x1x1y1y1),

y3 =y1y1 � x1x1

a(1� x1x1y1y1).

S2 + C2 = Z2, k2S2 + D2 = Z2.

2007.01.10, � 09:30,

Bernstein–Lange:

10M + 1S + 1A.

S: field squaring.

Karatsuba

Edwards, continued:

x2 + y2 = a2(1 + x2y2)

x2 + y2 = a2(1 + x2y2) has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

a(1 + x1x2y1y2),

y3 =y1y2 � x1x2

a(1� x1x2y1y2).

(x1; y1) + (x1; y1) = (x3; y3) with

x3 =x1y1 + y1x1

a(1 + x1x1y1y1),

y3 =y1y1 � x1x1

a(1� x1x1y1y1).

S2 + C2 = Z2, k2S2 + D2 = Z2.

2007.01.10, � 09:30,

Bernstein–Lange:

10M + 1S + 1A.

S: field squaring.

Karatsuba

(x1; y1) + (x1; y1) = (x3; y3) with

x3 =x1y1 + y1x1

a(1 + x1x1y1y1),

y3 =y1y1 � x1x1

a(1� x1x1y1y1).

S2 + C2 = Z2, k2S2 + D2 = Z2.

2007.01.10, � 09:30,

Bernstein–Lange:

10M + 1S + 1A.

S: field squaring.

Karatsuba

(x1; y1) + (x1; y1) = (x3; y3) with

x3 =x1y1 + y1x1

a(1 + x1x1y1y1),

y3 =y1y1 � x1x1

a(1� x1x1y1y1).

S2 + C2 = Z2, k2S2 + D2 = Z2.

2007.01.10, � 09:30,

Bernstein–Lange:

10M + 1S + 1A.

S: field squaring.

Karatsuba

Edwards paper: Bulletin AMS

44 (2007), 393–422.

Many papers in 2007, 2008, 2009

have now used Edwards curves

to set speed records

for critical computations

in elliptic-curve cryptography.

Also new speed records

for ECM factorization: see

Lange’s talk here on Saturday.

Also expect speedups in verifying

elliptic-curve primality proofs.

(x1; y1) + (x1; y1) = (x3; y3) with

x3 =x1y1 + y1x1

a(1 + x1x1y1y1),

y3 =y1y1 � x1x1

a(1� x1x1y1y1).

S2 + C2 = Z2, k2S2 + D2 = Z2.

2007.01.10, � 09:30,

Bernstein–Lange:

10M + 1S + 1A.

S: field squaring.

Karatsuba

44 (2007), 393–422.

Many papers in 2007, 2008, 2009

(x1; y1) + (x1; y1) = (x3; y3) with

x3 =x1y1 + y1x1

a(1 + x1x1y1y1),

y3 =y1y1 � x1x1

a(1� x1x1y1y1).

S2 + C2 = Z2, k2S2 + D2 = Z2.

2007.01.10, � 09:30,

Bernstein–Lange:

10M + 1S + 1A.

S: field squaring.

Karatsuba

44 (2007), 393–422.

Many papers in 2007, 2008, 2009

2007.01.10, � 09:30,

Bernstein–Lange:

10M + 1S + 1A.

S: field squaring.

Karatsuba

44 (2007), 393–422.

Many papers in 2007, 2008, 2009

2007.01.10, � 09:30,

Bernstein–Lange:

10M + 1S + 1A.

S: field squaring.

Karatsuba

44 (2007), 393–422.

Many papers in 2007, 2008, 2009

Back to B.–L., early 2007.

Edwards x2 + y2 = a2(1 + x2y2)

doesn’t rationally include

Euler–Gauss x2 + y2 = 1� x2y2.

Common generalization,

presumably more curves over Q,

presumably more curves over Fq:x2 + y2 = 2(1 + dx2y2) has

neutral element (0; ), addition

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

(1 + dx1x2y1y2),

y3 =y1y2 � x1x2

(1� dx1x2y1y2).

2007.01.10, � 09:30,

Bernstein–Lange:

10M + 1S + 1A.

S: field squaring.

Karatsuba

44 (2007), 393–422.

Many papers in 2007, 2008, 2009

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

(1 + dx1x2y1y2),

y3 =y1y2 � x1x2

(1� dx1x2y1y2).

2007.01.10, � 09:30,

Bernstein–Lange:

10M + 1S + 1A.

S: field squaring.

Karatsuba

44 (2007), 393–422.

Many papers in 2007, 2008, 2009

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

(1 + dx1x2y1y2),

y3 =y1y2 � x1x2

(1� dx1x2y1y2).

44 (2007), 393–422.

Many papers in 2007, 2008, 2009

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

(1 + dx1x2y1y2),

y3 =y1y2 � x1x2

(1� dx1x2y1y2).

44 (2007), 393–422.

Many papers in 2007, 2008, 2009

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

(1 + dx1x2y1y2),

y3 =y1y2 � x1x2

(1� dx1x2y1y2).

Convenient to take = 1

for speed, simplicity.

Covers same set of curves

up to birational equivalence:

( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has

neutral element (0; 1), addition

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

44 (2007), 393–422.

Many papers in 2007, 2008, 2009

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

(1 + dx1x2y1y2),

y3 =y1y2 � x1x2

(1� dx1x2y1y2).

( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

44 (2007), 393–422.

Many papers in 2007, 2008, 2009

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

(1 + dx1x2y1y2),

y3 =y1y2 � x1x2

(1� dx1x2y1y2).

( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

(1 + dx1x2y1y2),

y3 =y1y2 � x1x2

(1� dx1x2y1y2).

( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

(1 + dx1x2y1y2),

y3 =y1y2 � x1x2

(1� dx1x2y1y2).

( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

Hmmm, does this really work?

Easiest way to check

the generalized addition law:

pull out the computer!

Pick a prime p; e.g. 47.

Pick curve param d 2 Fp.Enumerate all affine points

(x; y) 2 Fp � Fp satisfying

x2 + y2 = 1 + dx2y2.

Use generalized addition law

to make an addition table

for all pairs of points.

Check associativity etc.

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

(1 + dx1x2y1y2),

y3 =y1y2 � x1x2

(1� dx1x2y1y2).

( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

x2 + y2 = 1 + dx2y2.

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

(1 + dx1x2y1y2),

y3 =y1y2 � x1x2

(1� dx1x2y1y2).

( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

x2 + y2 = 1 + dx2y2.

( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

x2 + y2 = 1 + dx2y2.

( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

x2 + y2 = 1 + dx2y2.

Warning: Don’t expect

complete addition table.

Addition law works generically

but can fail for some

exceptional pairs of points.

Unified addition law

works for generic additions

and for generic doublings

Basic problem: Denominators

1� dx1x2y1y2 can be zero.

( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

x2 + y2 = 1 + dx2y2.

( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has

(x1; y1) + (x2; y2) = (x3; y3) with

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

x2 + y2 = 1 + dx2y2.

Even if we switched to

projective coordinates,

would expect addition law

to fail for some points,

producing (0 : 0 : 0).

1995 Bosma–Lenstra theorem:

“The smallest cardinality of a

complete system of addition laws

on E equals two.”

Bosma Lenstra

x2 + y2 = 1 + dx2y2.

on E equals two.”

Bosma Lenstra

x2 + y2 = 1 + dx2y2.

on E equals two.”

Bosma Lenstra

on E equals two.”

Bosma Lenstra

on E equals two.”

Bosma Lenstra

Try p = 47, d = 25:

denominator 1� dx1x2y1y2

is nonzero for most points

(x1; y1), (x2; y2) on curve.

Edwards addition law is

associative whenever defined.

on E equals two.”

Bosma Lenstra

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

on E equals two.”

Bosma Lenstra

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

on E equals two.”

Bosma Lenstra

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

on E equals two.”

Bosma Lenstra

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

Try p = 47, d = �1:

is nonzero for all points

(x1; y1), (x2; y2) on curve.

Addition law is a group law!

on E equals two.”

Bosma Lenstra

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

Try p = 47, d = �1:

(x1; y1), (x2; y2) on curve.

vs.

Z60T

on E equals two.”

Bosma Lenstra

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

Try p = 47, d = �1:

(x1; y1), (x2; y2) on curve.

vs.

Z60T

2007 Bernstein–Lange

completeness proof

for all non-square d:If x2

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

and dx1x2y1y2 = �1

on E equals two.”

Bosma Lenstra

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

Try p = 47, d = �1:

(x1; y1), (x2; y2) on curve.

vs.

Z60T

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

on E equals two.”

Bosma Lenstra

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

Try p = 47, d = �1:

(x1; y1), (x2; y2) on curve.

vs.

Z60T

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

Try p = 47, d = �1:

(x1; y1), (x2; y2) on curve.

vs.

Z60T

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

Try p = 47, d = �1:

(x1; y1), (x2; y2) on curve.

vs.

Z60T

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

then dx21y2

1(x2 + y2)2

= dx21y2

1(x22 + y2

2 + 2x2y2)

= dx21y2

1(dx22y2

2 + 1 + 2x2y2)

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

Try p = 47, d = �1:

(x1; y1), (x2; y2) on curve.

vs.

Z60T

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

then dx21y2

1(x2 + y2)2

= dx21y2

1(x22 + y2

2 + 2x2y2)

= dx21y2

1(dx22y2

2 + 1 + 2x2y2)

= d2x21y2

1x22y2

2+dx21y2

1+2dx21y2

1x2y2

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

Try p = 47, d = �1:

(x1; y1), (x2; y2) on curve.

vs.

Z60T

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

then dx21y2

1(x2 + y2)2

= dx21y2

1(x22 + y2

2 + 2x2y2)

= dx21y2

1(dx22y2

2 + 1 + 2x2y2)

= d2x21y2

1x22y2

2+dx21y2

1+2dx21y2

1x2y2

= 1 + dx21y2

1 � 2x1y1

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

Try p = 47, d = �1:

(x1; y1), (x2; y2) on curve.

vs.

Z60T

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

then dx21y2

1(x2 + y2)2

= dx21y2

1(x22 + y2

2 + 2x2y2)

= dx21y2

1(dx22y2

2 + 1 + 2x2y2)

= d2x21y2

1x22y2

2+dx21y2

1+2dx21y2

1x2y2

= 1 + dx21y2

1 � 2x1y1

= x21 + y2

1 � 2x1y1 = (x1 � y1)2.

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

Try p = 47, d = �1:

(x1; y1), (x2; y2) on curve.

vs.

Z60T

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

then dx21y2

1(x2 + y2)2

= dx21y2

1(x22 + y2

2 + 2x2y2)

= dx21y2

1(dx22y2

2 + 1 + 2x2y2)

= d2x21y2

1x22y2

2+dx21y2

1+2dx21y2

1x2y2

= 1 + dx21y2

1 � 2x1y1

= x21 + y2

1 � 2x1y1 = (x1 � y1)2.

Have x2 + y2 6= 0 or x2 � y2 6= 0;

either way d is a square. Q.E.D.

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

Try p = 47, d = �1:

(x1; y1), (x2; y2) on curve.

vs.

Z60T

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

then dx21y2

1(x2 + y2)2

= dx21y2

1(x22 + y2

2 + 2x2y2)

= dx21y2

1(dx22y2

2 + 1 + 2x2y2)

= d2x21y2

1x22y2

2+dx21y2

1+2dx21y2

1x2y2

= 1 + dx21y2

1 � 2x1y1

= x21 + y2

1 � 2x1y1 = (x1 � y1)2.

Have x2 + y2 6= 0 or x2 � y2 6= 0;

on E equals two.”

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

Try p = 47, d = �1:

(x1; y1), (x2; y2) on curve.

vs.

Z60T

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

then dx21y2

1(x2 + y2)2

= dx21y2

1(x22 + y2

2 + 2x2y2)

= dx21y2

1(dx22y2

2 + 1 + 2x2y2)

= d2x21y2

1x22y2

2+dx21y2

1+2dx21y2

1x2y2

= 1 + dx21y2

1 � 2x1y1

= x21 + y2

1 � 2x1y1 = (x1 � y1)2.

Have x2 + y2 6= 0 or x2 � y2 6= 0;

on E equals two.”

Try p = 47, d = 25:

(x1; y1), (x2; y2) on curve.

Try p = 47, d = �1:

(x1; y1), (x2; y2) on curve.

vs.

Z60T

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

then dx21y2

1(x2 + y2)2

= dx21y2

1(x22 + y2

2 + 2x2y2)

= dx21y2

1(dx22y2

2 + 1 + 2x2y2)

= d2x21y2

1x22y2

2+dx21y2

1+2dx21y2

1x2y2

= 1 + dx21y2

1 � 2x1y1

= x21 + y2

1 � 2x1y1 = (x1 � y1)2.

Have x2 + y2 6= 0 or x2 � y2 6= 0;

on E equals two.”

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

then dx21y2

1(x2 + y2)2

= dx21y2

1(x22 + y2

2 + 2x2y2)

= dx21y2

1(dx22y2

2 + 1 + 2x2y2)

= d2x21y2

1x22y2

2+dx21y2

1+2dx21y2

1x2y2

= 1 + dx21y2

1 � 2x1y1

= x21 + y2

1 � 2x1y1 = (x1 � y1)2.

Have x2 + y2 6= 0 or x2 � y2 6= 0;

on E equals two.”

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

then dx21y2

1(x2 + y2)2

= dx21y2

1(x22 + y2

2 + 2x2y2)

= dx21y2

1(dx22y2

2 + 1 + 2x2y2)

= d2x21y2

1x22y2

2+dx21y2

1+2dx21y2

1x2y2

= 1 + dx21y2

1 � 2x1y1

= x21 + y2

1 � 2x1y1 = (x1 � y1)2.

Have x2 + y2 6= 0 or x2 � y2 6= 0;

on E equals two.” : : : meaning:

Any addition formula

for a Weierstrass curve Ein projective coordinates

must have exceptional cases

in E(k)� E(k), where

k = algebraic closure of k.

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

then dx21y2

1(x2 + y2)2

= dx21y2

1(x22 + y2

2 + 2x2y2)

= dx21y2

1(dx22y2

2 + 1 + 2x2y2)

= d2x21y2

1x22y2

2+dx21y2

1+2dx21y2

1x2y2

= 1 + dx21y2

1 � 2x1y1

= x21 + y2

1 � 2x1y1 = (x1 � y1)2.

Have x2 + y2 6= 0 or x2 � y2 6= 0;

Edwards addition formula has

exceptional cases for E(k)

: : : but not for E(k).

We do computations in E(k).

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

then dx21y2

1(x2 + y2)2

= dx21y2

1(x22 + y2

2 + 2x2y2)

= dx21y2

1(dx22y2

2 + 1 + 2x2y2)

= d2x21y2

1x22y2

2+dx21y2

1+2dx21y2

1x2y2

= 1 + dx21y2

1 � 2x1y1

= x21 + y2

1 � 2x1y1 = (x1 � y1)2.

Have x2 + y2 6= 0 or x2 � y2 6= 0;

Summary: Assume k field;

2 6= 0 in k; non-square d 2 k.

Then f(x; y) 2 k� k :

x2 + y2 = 1 + dx2y2gis a commutative group with

(x1; y1) + (x2; y2) = (x3; y3)

defined by Edwards addition law:

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

Terminology: “Edwards curves”

allow arbitrary d 2 k�; d = 4are “original Edwards curves”;

non-square d are “complete.”

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

then dx21y2

1(x2 + y2)2

= dx21y2

1(x22 + y2

2 + 2x2y2)

= dx21y2

1(dx22y2

2 + 1 + 2x2y2)

= d2x21y2

1x22y2

2+dx21y2

1+2dx21y2

1x2y2

= 1 + dx21y2

1 � 2x1y1

= x21 + y2

1 � 2x1y1 = (x1 � y1)2.

Have x2 + y2 6= 0 or x2 � y2 6= 0;

(x1; y1) + (x2; y2) = (x3; y3)

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

completeness proof

1 + y21 = 1 + dx2

1y21

and x22 + y2

2 = 1 + dx22y2

2

then dx21y2

1(x2 + y2)2

= dx21y2

1(x22 + y2

2 + 2x2y2)

= dx21y2

1(dx22y2

2 + 1 + 2x2y2)

= d2x21y2

1x22y2

2+dx21y2

1+2dx21y2

1x2y2

= 1 + dx21y2

1 � 2x1y1

= x21 + y2

1 � 2x1y1 = (x1 � y1)2.

Have x2 + y2 6= 0 or x2 � y2 6= 0;

(x1; y1) + (x2; y2) = (x3; y3)

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

(x1; y1) + (x2; y2) = (x3; y3)

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

(x1; y1) + (x2; y2) = (x3; y3)

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

d = 0: “the clock group.”

x2 + y2 = 1, parametrized

by (x; y) = (sin; cos).

Gauss parametrized

x2 + y2 = 1� x2y2 by

(x; y) = (“lemn sin”; “lemn cos”).

Abel, Jacobi “sn, cn, dn”

cover all elliptic curves,

but (sn; cn) does not

specialize to (sin; cos)

or to (lemn sin; lemn cos).

Edwards x is sn;

Edwards y is cn/dn.

Theta view: see Edwards paper.

(x1; y1) + (x2; y2) = (x3; y3)

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

Gauss parametrized

x2 + y2 = 1� x2y2 by

Edwards x is sn;

Edwards y is cn/dn.

(x1; y1) + (x2; y2) = (x3; y3)

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

Gauss parametrized

x2 + y2 = 1� x2y2 by

Edwards x is sn;

Edwards y is cn/dn.

(x1; y1) + (x2; y2) = (x3; y3)

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

Gauss parametrized

x2 + y2 = 1� x2y2 by

Edwards x is sn;

Edwards y is cn/dn.

(x1; y1) + (x2; y2) = (x3; y3)

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

Gauss parametrized

x2 + y2 = 1� x2y2 by

Edwards x is sn;

Edwards y is cn/dn.

Every elliptic curve over kwith a point of order 4

is birationally equivalent

to an Edwards curve.

Unique order-2 point ) complete.

Convenient for implementors:

no need to worry about

accidentally bumping into

exceptional inputs.

Particularly nice for cryptography:

attackers manufacturing

exceptional inputs,

hearing case distinctions, etc.

(x1; y1) + (x2; y2) = (x3; y3)

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

Gauss parametrized

x2 + y2 = 1� x2y2 by

Edwards x is sn;

Edwards y is cn/dn.

exceptional inputs.

exceptional inputs,

(x1; y1) + (x2; y2) = (x3; y3)

x3 =x1y2 + y1x2

1 + dx1x2y1y2,

y3 =y1y2 � x1x2

1� dx1x2y1y2.

Gauss parametrized

x2 + y2 = 1� x2y2 by

Edwards x is sn;

Edwards y is cn/dn.

exceptional inputs.

exceptional inputs,

Gauss parametrized

x2 + y2 = 1� x2y2 by

Edwards x is sn;

Edwards y is cn/dn.

exceptional inputs.

exceptional inputs,

Gauss parametrized

x2 + y2 = 1� x2y2 by

Edwards x is sn;

Edwards y is cn/dn.

exceptional inputs.

exceptional inputs,

What about elliptic curves

without points of order 4?

over binary fields?

Continuing project (B.–L.):

For every elliptic curve E,

find complete addition law for Ewith best possible speeds.

Complete laws are useful

even if slower than Edwards!

Gauss parametrized

x2 + y2 = 1� x2y2 by

Edwards x is sn;

Edwards y is cn/dn.

exceptional inputs.

exceptional inputs,

over binary fields?

Gauss parametrized

x2 + y2 = 1� x2y2 by

Edwards x is sn;

Edwards y is cn/dn.

exceptional inputs.

exceptional inputs,

over binary fields?

exceptional inputs.

exceptional inputs,

over binary fields?

exceptional inputs.

exceptional inputs,

over binary fields?

2008 B.–Birkner–L.–Peters:

“twisted Edwards curves”

ax2 + y2 = 1 + dx2y2

cover all Montgomery curves.

Almost as fast as a = 1;

brings Edwards speed

to larger class of curves.

2008 B.–B.–Joye–L.–P.:

every elliptic curve over Fpwhere 4 divides group order

is (1 or 2)-isogenous

to a twisted Edwards curve.

exceptional inputs.

exceptional inputs,

over binary fields?

ax2 + y2 = 1 + dx2y2

2008 B.–B.–Joye–L.–P.:

exceptional inputs.

exceptional inputs,

over binary fields?

ax2 + y2 = 1 + dx2y2

2008 B.–B.–Joye–L.–P.:

over binary fields?

ax2 + y2 = 1 + dx2y2

2008 B.–B.–Joye–L.–P.:

over binary fields?

ax2 + y2 = 1 + dx2y2

2008 B.–B.–Joye–L.–P.:

Statistics for many p 2 1 + 4Z,

� number of pairs (j(E);#E):

Curves total odd 2odd 4odd 8odd

orig 124p 0 0 0 0

compl 12p 0 0 1

4p 18p

Ed 23p 0 0 1

4p 316p

twist 56p 0 0 5

12p 316p

4Z 56p 0 0 5

12p 316p

all 2p 23p 1

2p 512p 3

16pDifferent statistics for 3 + 4Z.

Bad news:

complete twisted Edwards

� complete Edwards!

over binary fields?

ax2 + y2 = 1 + dx2y2

2008 B.–B.–Joye–L.–P.:

orig 124p 0 0 0 0

compl 12p 0 0 1

4p 18p

Ed 23p 0 0 1

4p 316p

twist 56p 0 0 5

12p 316p

4Z 56p 0 0 5

12p 316p

all 2p 23p 1

2p 512p 3

Bad news:

over binary fields?

ax2 + y2 = 1 + dx2y2

2008 B.–B.–Joye–L.–P.:

orig 124p 0 0 0 0

compl 12p 0 0 1

4p 18p

Ed 23p 0 0 1

4p 316p

twist 56p 0 0 5

12p 316p

4Z 56p 0 0 5

12p 316p

all 2p 23p 1

2p 512p 3

Bad news:

ax2 + y2 = 1 + dx2y2

2008 B.–B.–Joye–L.–P.:

orig 124p 0 0 0 0

compl 12p 0 0 1

4p 18p

Ed 23p 0 0 1

4p 316p

twist 56p 0 0 5

12p 316p

4Z 56p 0 0 5

12p 316p

all 2p 23p 1

2p 512p 3

Bad news:

ax2 + y2 = 1 + dx2y2

2008 B.–B.–Joye–L.–P.:

orig 124p 0 0 0 0

compl 12p 0 0 1

4p 18p

Ed 23p 0 0 1

4p 316p

twist 56p 0 0 5

12p 316p

4Z 56p 0 0 5

12p 316p

all 2p 23p 1

2p 512p 3

Bad news:

Some Newton polygons

��

�� JJJJJJ

J

Short Weierstrass

��

�� OOOOOOOO

Jacobi quartic

��

�

�� ??

????

??

Hessian

��

�Edwards

1893 Baker: genus is generically

number of interior points.

2000 Poonen–Rodriguez-Villegas

classified genus-1 polygons.

ax2 + y2 = 1 + dx2y2

2008 B.–B.–Joye–L.–P.:

orig 124p 0 0 0 0

compl 12p 0 0 1

4p 18p

Ed 23p 0 0 1

4p 316p

twist 56p 0 0 5

12p 316p

4Z 56p 0 0 5

12p 316p

all 2p 23p 1

2p 512p 3

Bad news:

��

�� JJJJJJ

J

Short Weierstrass

��

�� OOOOOOOO

Jacobi quartic

��

�

�� ??

????

??

Hessian

��

�Edwards

ax2 + y2 = 1 + dx2y2

2008 B.–B.–Joye–L.–P.:

orig 124p 0 0 0 0

compl 12p 0 0 1

4p 18p

Ed 23p 0 0 1

4p 316p

twist 56p 0 0 5

12p 316p

4Z 56p 0 0 5

12p 316p

all 2p 23p 1

2p 512p 3

Bad news:

��

�� JJJJJJ

J

Short Weierstrass

��

�� OOOOOOOO

Jacobi quartic

��

�

�� ??

????

??

Hessian

��

�Edwards

orig 124p 0 0 0 0

compl 12p 0 0 1

4p 18p

Ed 23p 0 0 1

4p 316p

twist 56p 0 0 5

12p 316p

4Z 56p 0 0 5

12p 316p

all 2p 23p 1

2p 512p 3

Bad news:

��

�� JJJJJJ

J

Short Weierstrass

��

�� OOOOOOOO

Jacobi quartic

��

�

�� ??

????

??

Hessian

��

�Edwards

orig 124p 0 0 0 0

compl 12p 0 0 1

4p 18p

Ed 23p 0 0 1

4p 316p

twist 56p 0 0 5

12p 316p

4Z 56p 0 0 5

12p 316p

all 2p 23p 1

2p 512p 3

Bad news:

��

�� JJJJJJ

J

Short Weierstrass

��

�� OOOOOOOO

Jacobi quartic

��

�

�� ??

????

??

Hessian

��

�Edwards

How to generalize Edwards?

Design decision: want

quadratic in x and in y.

x$ y symmetry.

d00

d10

d20

d10

d11

d21

d20

d21

d22

Curve shape d00 + d10(x + y) +

d11xy + d20(x2 + y2) +

d21xy(x + y) + d22x2y2 = 0.

orig 124p 0 0 0 0

compl 12p 0 0 1

4p 18p

Ed 23p 0 0 1

4p 316p

twist 56p 0 0 5

12p 316p

4Z 56p 0 0 5

12p 316p

all 2p 23p 1

2p 512p 3

Bad news:

��

�� JJJJJJ

J

Short Weierstrass

��

�� OOOOOOOO

Jacobi quartic

��

�

�� ??

????

??

Hessian

��

�Edwards

x$ y symmetry.

d00

d10

d20

d10

d11

d21

d20

d21

d22

d11xy + d20(x2 + y2) +

d21xy(x + y) + d22x2y2 = 0.

orig 124p 0 0 0 0

compl 12p 0 0 1

4p 18p

Ed 23p 0 0 1

4p 316p

twist 56p 0 0 5

12p 316p

4Z 56p 0 0 5

12p 316p

all 2p 23p 1

2p 512p 3

Bad news:

��

�� JJJJJJ

J

Short Weierstrass

��

�� OOOOOOOO

Jacobi quartic

��

�

�� ??

????

??

Hessian

��

�Edwards

x$ y symmetry.

d00

d10

d20

d10

d11

d21

d20

d21

d22

d11xy + d20(x2 + y2) +

d21xy(x + y) + d22x2y2 = 0.

��

�� JJJJJJ

J

Short Weierstrass

��

�� OOOOOOOO

Jacobi quartic

��

�

�� ??

????

??

Hessian

��

�Edwards

x$ y symmetry.

d00

d10

d20

d10

d11

d21

d20

d21

d22

d11xy + d20(x2 + y2) +

d21xy(x + y) + d22x2y2 = 0.

��

�� JJJJJJ

J

Short Weierstrass

��

�� OOOOOOOO

Jacobi quartic

��

�

�� ??

????

??

Hessian

��

�Edwards

x$ y symmetry.

d00

d10

d20

d10

d11

d21

d20

d21

d22

d11xy + d20(x2 + y2) +

d21xy(x + y) + d22x2y2 = 0.

Suppose that d22 = 0:

d00

d10

d20

d10

d11

d21

d20

d21

�

Genus 1 ) (1; 1) is an

interior point ) d21 6= 0.

Homogenize:

d00Z3 + d10(X + Y )Z2 +

d11XY Z + d20(X2 + Y 2)Z +

d21XY (X + Y ) = 0.

��

�� JJJJJJ

J

Short Weierstrass

��

�� OOOOOOOO

Jacobi quartic

��

�

�� ??

????

??

Hessian

��

�Edwards

x$ y symmetry.

d00

d10

d20

d10

d11

d21

d20

d21

d22

d11xy + d20(x2 + y2) +

d21xy(x + y) + d22x2y2 = 0.

d00

d10

d20

d10

d11

d21

d20

d21

�

Homogenize:

d00Z3 + d10(X + Y )Z2 +

d11XY Z + d20(X2 + Y 2)Z +

d21XY (X + Y ) = 0.

��

�� JJJJJJ

J

Short Weierstrass

��

�� OOOOOOOO

Jacobi quartic

��

�

�� ??

????

??

Hessian

��

�Edwards

x$ y symmetry.

d00

d10

d20

d10

d11

d21

d20

d21

d22

d11xy + d20(x2 + y2) +

d21xy(x + y) + d22x2y2 = 0.

d00

d10

d20

d10

d11

d21

d20

d21

�

Homogenize:

d00Z3 + d10(X + Y )Z2 +

d11XY Z + d20(X2 + Y 2)Z +

d21XY (X + Y ) = 0.

x$ y symmetry.

d00

d10

d20

d10

d11

d21

d20

d21

d22

d11xy + d20(x2 + y2) +

d21xy(x + y) + d22x2y2 = 0.

d00

d10

d20

d10

d11

d21

d20

d21

�

Homogenize:

d00Z3 + d10(X + Y )Z2 +

d11XY Z + d20(X2 + Y 2)Z +

d21XY (X + Y ) = 0.

x$ y symmetry.

d00

d10

d20

d10

d11

d21

d20

d21

d22

d11xy + d20(x2 + y2) +

d21xy(x + y) + d22x2y2 = 0.

d00

d10

d20

d10

d11

d21

d20

d21

�

Homogenize:

d00Z3 + d10(X + Y )Z2 +

d11XY Z + d20(X2 + Y 2)Z +

d21XY (X + Y ) = 0.

Points at 1 are (X : Y : 0)

with d21XY (X + Y ) = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).

Study (1 : 0 : 0) by setting

y = Y=X, z = Z=Xin homogeneous curve equation:

d00z3 + d10(1 + y)z2 +

d11yz + d20(1 + y2)z +

d21y(1 + y) = 0.

Nonzero coefficient of yso (1 : 0 : 0) is nonsingular.

Addition law cannot be complete

(unless k is tiny).

x$ y symmetry.

d00

d10

d20

d10

d11

d21

d20

d21

d22

d11xy + d20(x2 + y2) +

d21xy(x + y) + d22x2y2 = 0.

d00

d10

d20

d10

d11

d21

d20

d21

�

Homogenize:

d00Z3 + d10(X + Y )Z2 +

d11XY Z + d20(X2 + Y 2)Z +

d21XY (X + Y ) = 0.

with d21XY (X + Y ) = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).

d00z3 + d10(1 + y)z2 +

d11yz + d20(1 + y2)z +

d21y(1 + y) = 0.

(unless k is tiny).

x$ y symmetry.

d00

d10

d20

d10

d11

d21

d20

d21

d22

d11xy + d20(x2 + y2) +

d21xy(x + y) + d22x2y2 = 0.

d00

d10

d20

d10

d11

d21

d20

d21

�

Homogenize:

d00Z3 + d10(X + Y )Z2 +

d11XY Z + d20(X2 + Y 2)Z +

d21XY (X + Y ) = 0.

with d21XY (X + Y ) = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).

d00z3 + d10(1 + y)z2 +

d11yz + d20(1 + y2)z +

d21y(1 + y) = 0.

(unless k is tiny).

d00

d10

d20

d10

d11

d21

d20

d21

�

Homogenize:

d00Z3 + d10(X + Y )Z2 +

d11XY Z + d20(X2 + Y 2)Z +

d21XY (X + Y ) = 0.

with d21XY (X + Y ) = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).

d00z3 + d10(1 + y)z2 +

d11yz + d20(1 + y2)z +

d21y(1 + y) = 0.

(unless k is tiny).

d00

d10

d20

d10

d11

d21

d20

d21

�

Homogenize:

d00Z3 + d10(X + Y )Z2 +

d11XY Z + d20(X2 + Y 2)Z +

d21XY (X + Y ) = 0.

with d21XY (X + Y ) = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).

d00z3 + d10(1 + y)z2 +

d11yz + d20(1 + y2)z +

d21y(1 + y) = 0.

(unless k is tiny).

So we require d22 6= 0.

with d22X2Y 2 = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0).

Study (1 : 0 : 0) again:

d00z4 + d10(1 + y)z3 +

d11yz2 + d20(1 + y2)z2 +

d21y(1 + y)z + d22y2 = 0.

Coefficients of 1; y; z are 0

so (1 : 0 : 0) is singular.

d00

d10

d20

d10

d11

d21

d20

d21

�

Homogenize:

d00Z3 + d10(X + Y )Z2 +

d11XY Z + d20(X2 + Y 2)Z +

d21XY (X + Y ) = 0.

with d21XY (X + Y ) = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).

d00z3 + d10(1 + y)z2 +

d11yz + d20(1 + y2)z +

d21y(1 + y) = 0.

(unless k is tiny).

with d22X2Y 2 = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0).

d00z4 + d10(1 + y)z3 +

d11yz2 + d20(1 + y2)z2 +

d21y(1 + y)z + d22y2 = 0.

d00

d10

d20

d10

d11

d21

d20

d21

�

Homogenize:

d00Z3 + d10(X + Y )Z2 +

d11XY Z + d20(X2 + Y 2)Z +

d21XY (X + Y ) = 0.

with d21XY (X + Y ) = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).

d00z3 + d10(1 + y)z2 +

d11yz + d20(1 + y2)z +

d21y(1 + y) = 0.

(unless k is tiny).

with d22X2Y 2 = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0).

d00z4 + d10(1 + y)z3 +

d11yz2 + d20(1 + y2)z2 +

d21y(1 + y)z + d22y2 = 0.

with d21XY (X + Y ) = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).

d00z3 + d10(1 + y)z2 +

d11yz + d20(1 + y2)z +

d21y(1 + y) = 0.

(unless k is tiny).

with d22X2Y 2 = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0).

d00z4 + d10(1 + y)z3 +

d11yz2 + d20(1 + y2)z2 +

d21y(1 + y)z + d22y2 = 0.

with d21XY (X + Y ) = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).

d00z3 + d10(1 + y)z2 +

d11yz + d20(1 + y2)z +

d21y(1 + y) = 0.

(unless k is tiny).

with d22X2Y 2 = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0).

d00z4 + d10(1 + y)z3 +

d11yz2 + d20(1 + y2)z2 +

d21y(1 + y)z + d22y2 = 0.

Put y = uz, divide by z2

to blow up singularity:

d00z2 + d10(1 + uz)z +

d11uz + d20(1 + u2z2) +

d21u(1 + uz) + d22u2 = 0.

Substitute z = 0 to find

points above singularity:

d20 + d21u + d22u2 = 0.

We require the quadratic

d20 + d21u + d22u2

to be irreducible in k.

Special case: complete Edwards,

1� du2 irreducible in k.

with d21XY (X + Y ) = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).

d00z3 + d10(1 + y)z2 +

d11yz + d20(1 + y2)z +

d21y(1 + y) = 0.

(unless k is tiny).

with d22X2Y 2 = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0).

d00z4 + d10(1 + y)z3 +

d11yz2 + d20(1 + y2)z2 +

d21y(1 + y)z + d22y2 = 0.

d00z2 + d10(1 + uz)z +

d11uz + d20(1 + u2z2) +

d21u(1 + uz) + d22u2 = 0.

d20 + d21u + d22u2 = 0.

d20 + d21u + d22u2

with d21XY (X + Y ) = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).

d00z3 + d10(1 + y)z2 +

d11yz + d20(1 + y2)z +

d21y(1 + y) = 0.

(unless k is tiny).

with d22X2Y 2 = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0).

d00z4 + d10(1 + y)z3 +

d11yz2 + d20(1 + y2)z2 +

d21y(1 + y)z + d22y2 = 0.

d00z2 + d10(1 + uz)z +

d11uz + d20(1 + u2z2) +

d21u(1 + uz) + d22u2 = 0.

d20 + d21u + d22u2 = 0.

d20 + d21u + d22u2

with d22X2Y 2 = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0).

d00z4 + d10(1 + y)z3 +

d11yz2 + d20(1 + y2)z2 +

d21y(1 + y)z + d22y2 = 0.

d00z2 + d10(1 + uz)z +

d11uz + d20(1 + u2z2) +

d21u(1 + uz) + d22u2 = 0.

d20 + d21u + d22u2 = 0.

d20 + d21u + d22u2

with d22X2Y 2 = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0).

d00z4 + d10(1 + y)z3 +

d11yz2 + d20(1 + y2)z2 +

d21y(1 + y)z + d22y2 = 0.

d00z2 + d10(1 + uz)z +

d11uz + d20(1 + u2z2) +

d21u(1 + uz) + d22u2 = 0.

d20 + d21u + d22u2 = 0.

d20 + d21u + d22u2

In particular d20 6= 0:

d00

d10

d20

d10

d11

d21

d20

d21

d22

Design decision: Explore

a deviation from Edwards.

Choose neutral element (0; 0).

d00 = 0; d10 6= 0.

Can vary neutral element.

Warning: bad choice can produce

surprisingly expensive negation.

with d22X2Y 2 = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0).

d00z4 + d10(1 + y)z3 +

d11yz2 + d20(1 + y2)z2 +

d21y(1 + y)z + d22y2 = 0.

d00z2 + d10(1 + uz)z +

d11uz + d20(1 + u2z2) +

d21u(1 + uz) + d22u2 = 0.

d20 + d21u + d22u2 = 0.

d20 + d21u + d22u2

d00

d10

d20

d10

d11

d21

d20

d21

d22

d00 = 0; d10 6= 0.

with d22X2Y 2 = 0: i.e.,

(1 : 0 : 0), (0 : 1 : 0).

d00z4 + d10(1 + y)z3 +

d11yz2 + d20(1 + y2)z2 +

d21y(1 + y)z + d22y2 = 0.

d00z2 + d10(1 + uz)z +

d11uz + d20(1 + u2z2) +

d21u(1 + uz) + d22u2 = 0.

d20 + d21u + d22u2 = 0.

d20 + d21u + d22u2

d00

d10

d20

d10

d11

d21

d20

d21

d22

d00 = 0; d10 6= 0.

d00z2 + d10(1 + uz)z +

d11uz + d20(1 + u2z2) +

d21u(1 + uz) + d22u2 = 0.

d20 + d21u + d22u2 = 0.

d20 + d21u + d22u2

d00

d10

d20

d10

d11

d21

d20

d21

d22

d00 = 0; d10 6= 0.

d00z2 + d10(1 + uz)z +

d11uz + d20(1 + u2z2) +

d21u(1 + uz) + d22u2 = 0.

d20 + d21u + d22u2 = 0.

d20 + d21u + d22u2

d00

d10

d20

d10

d11

d21

d20

d21

d22

d00 = 0; d10 6= 0.

Now have a Newton polygon

for generalized Edwards curves:

�

d10

d20

d10

d11

d21

d20

d21

d22

????????

By scaling x; yand scaling curve equation

can limit d10; d11; d20; d21; d22

to three degrees of freedom.

d00z2 + d10(1 + uz)z +

d11uz + d20(1 + u2z2) +

d21u(1 + uz) + d22u2 = 0.

d20 + d21u + d22u2 = 0.

d20 + d21u + d22u2

d00

d10

d20

d10

d11

d21

d20

d21

d22

d00 = 0; d10 6= 0.

�

d10

d20

d10

d11

d21

d20

d21

d22

????????

can limit d10; d11; d20; d21; d22

d00z2 + d10(1 + uz)z +

d11uz + d20(1 + u2z2) +

d21u(1 + uz) + d22u2 = 0.

d20 + d21u + d22u2 = 0.

d20 + d21u + d22u2

d00

d10

d20

d10

d11

d21

d20

d21

d22

d00 = 0; d10 6= 0.

�

d10

d20

d10

d11

d21

d20

d21

d22

????????

can limit d10; d11; d20; d21; d22

d00

d10

d20

d10

d11

d21

d20

d21

d22

d00 = 0; d10 6= 0.

�

d10

d20

d10

d11

d21

d20

d21

d22

????????

can limit d10; d11; d20; d21; d22

d00

d10

d20

d10

d11

d21

d20

d21

d22

d00 = 0; d10 6= 0.

�

d10

d20

d10

d11

d21

d20

d21

d22

????????

can limit d10; d11; d20; d21; d22

2008 B.–L.–Rezaeian Farashahi:

complete addition law for

“binary Edwards curves”

d1(x + y) + d2(x2 + y2) =

(x + x2)(y + y2).

Covers all ordinary elliptic curves

over F2n for n � 3.

Also surprisingly fast,

especially if d1 = d2.

d00

d10

d20

d10

d11

d21

d20

d21

d22

d00 = 0; d10 6= 0.

�

d10

d20

d10

d11

d21

d20

d21

d22

????????

can limit d10; d11; d20; d21; d22

d1(x + y) + d2(x2 + y2) =

(x + x2)(y + y2).

d00

d10

d20

d10

d11

d21

d20

d21

d22

d00 = 0; d10 6= 0.

�

d10

d20

d10

d11

d21

d20

d21

d22

????????

can limit d10; d11; d20; d21; d22

d1(x + y) + d2(x2 + y2) =

(x + x2)(y + y2).

�

d10

d20

d10

d11

d21

d20

d21

d22

????????

can limit d10; d11; d20; d21; d22

d1(x + y) + d2(x2 + y2) =

(x + x2)(y + y2).

�

d10

d20

d10

d11

d21

d20

d21

d22

????????

can limit d10; d11; d20; d21; d22

d1(x + y) + d2(x2 + y2) =

(x + x2)(y + y2).

2009 B.–L.:

another specialization

covering all the “NIST curves”

over non-binary fields.

�

d10

d20

d10

d11

d21

d20

d21

d22

????????

can limit d10; d11; d20; d21; d22

d1(x + y) + d2(x2 + y2) =

(x + x2)(y + y2).

2009 B.–L.:

Consider, e.g., the curve

x2 + y2 = x + y + txy + dx2y2

with d = �1 and

t =78751018041117252545420999954767176464538545060814630202841395651175859201799

over Fp where p = 2256 � 2224 +

2192 + 296 � 1.

Note: d is non-square in Fp.Birationally equivalent to

standard “NIST P-256” curve

v2 = u3 � 3u + a6 where

a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.

�

d10

d20

d10

d11

d21

d20

d21

d22

????????

can limit d10; d11; d20; d21; d22

d1(x + y) + d2(x2 + y2) =

(x + x2)(y + y2).

2009 B.–L.:

x2 + y2 = x + y + txy + dx2y2

with d = �1 and

t =78751018041117252545420999954767176464538545060814630202841395651175859201799

over Fp where p = 2256 � 2224 +

2192 + 296 � 1.

v2 = u3 � 3u + a6 where

a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.

�

d10

d20

d10

d11

d21

d20

d21

d22

????????

can limit d10; d11; d20; d21; d22

d1(x + y) + d2(x2 + y2) =

(x + x2)(y + y2).

2009 B.–L.:

x2 + y2 = x + y + txy + dx2y2

with d = �1 and

t =78751018041117252545420999954767176464538545060814630202841395651175859201799

over Fp where p = 2256 � 2224 +

2192 + 296 � 1.

v2 = u3 � 3u + a6 where

a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.

d1(x + y) + d2(x2 + y2) =

(x + x2)(y + y2).

2009 B.–L.:

x2 + y2 = x + y + txy + dx2y2

with d = �1 and

t =78751018041117252545420999954767176464538545060814630202841395651175859201799

over Fp where p = 2256 � 2224 +

2192 + 296 � 1.

v2 = u3 � 3u + a6 where

a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.

d1(x + y) + d2(x2 + y2) =

(x + x2)(y + y2).

2009 B.–L.:

x2 + y2 = x + y + txy + dx2y2

with d = �1 and

t =78751018041117252545420999954767176464538545060814630202841395651175859201799

over Fp where p = 2256 � 2224 +

2192 + 296 � 1.

v2 = u3 � 3u + a6 where

a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.

An addition law for

x2 + y2 = x + y + txy + dx2y2,

complete if d is not a square:

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

d1(x + y) + d2(x2 + y2) =

(x + x2)(y + y2).

2009 B.–L.:

x2 + y2 = x + y + txy + dx2y2

with d = �1 and

t =78751018041117252545420999954767176464538545060814630202841395651175859201799

over Fp where p = 2256 � 2224 +

2192 + 296 � 1.

v2 = u3 � 3u + a6 where

a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.

An addition law for

x2 + y2 = x + y + txy + dx2y2,

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

d1(x + y) + d2(x2 + y2) =

(x + x2)(y + y2).

2009 B.–L.:

x2 + y2 = x + y + txy + dx2y2

with d = �1 and

t =78751018041117252545420999954767176464538545060814630202841395651175859201799

over Fp where p = 2256 � 2224 +

2192 + 296 � 1.

v2 = u3 � 3u + a6 where

a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.

An addition law for

x2 + y2 = x + y + txy + dx2y2,

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

x2 + y2 = x + y + txy + dx2y2

with d = �1 and

t =78751018041117252545420999954767176464538545060814630202841395651175859201799

over Fp where p = 2256 � 2224 +

2192 + 296 � 1.

v2 = u3 � 3u + a6 where

a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.

An addition law for

x2 + y2 = x + y + txy + dx2y2,

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

x2 + y2 = x + y + txy + dx2y2

with d = �1 and

t =78751018041117252545420999954767176464538545060814630202841395651175859201799

over Fp where p = 2256 � 2224 +

2192 + 296 � 1.

v2 = u3 � 3u + a6 where

a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.

An addition law for

x2 + y2 = x + y + txy + dx2y2,

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

Note on computing addition laws:

An easy Magma script uses

Riemann–Roch to find addition

law given a curve shape.

Are those laws nice? No!

Find lower-degree laws by

Monagan–Pearce algorithm,

ISSAC 2006; or by evaluation at

random points on random curves.

Are those laws complete? No!

But always seems easy to

find complete addition laws

among low-degree laws where

denominator constant term 6= 0.

x2 + y2 = x + y + txy + dx2y2

with d = �1 and

t =78751018041117252545420999954767176464538545060814630202841395651175859201799

over Fp where p = 2256 � 2224 +

2192 + 296 � 1.

v2 = u3 � 3u + a6 where

a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.

An addition law for

x2 + y2 = x + y + txy + dx2y2,

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

x2 + y2 = x + y + txy + dx2y2

with d = �1 and

t =78751018041117252545420999954767176464538545060814630202841395651175859201799

over Fp where p = 2256 � 2224 +

2192 + 296 � 1.

v2 = u3 � 3u + a6 where

a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.

An addition law for

x2 + y2 = x + y + txy + dx2y2,

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

An addition law for

x2 + y2 = x + y + txy + dx2y2,

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

An addition law for

x2 + y2 = x + y + txy + dx2y2,

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

Birational equivalence from

x2 + y2 = x+ y + txy + dx2y2 to

v2 � (t + 2)uv + dv =

u3� (t+2)u2�du+(t+2)di.e. v2 � (t + 2)uv + dv =

(u2 � d)(u� (t + 2)):

u = (dxy + t + 2)=(x + y);

v =((t + 2)2 � d)x

(t + 2)xy + x + y .

Assuming t + 2 square, d not:

only exceptional point is

(0; 0), mapping to 1.

Inverse: x = v=(u2 � d);y = ((t + 2)u� v � d)=(u2 � d).

An addition law for

x2 + y2 = x + y + txy + dx2y2,

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

x2 + y2 = x+ y + txy + dx2y2 to

v2 � (t + 2)uv + dv =

(u2 � d)(u� (t + 2)):

u = (dxy + t + 2)=(x + y);

v =((t + 2)2 � d)x

(t + 2)xy + x + y .

An addition law for

x2 + y2 = x + y + txy + dx2y2,

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

x2 + y2 = x+ y + txy + dx2y2 to

v2 � (t + 2)uv + dv =

(u2 � d)(u� (t + 2)):

u = (dxy + t + 2)=(x + y);

v =((t + 2)2 � d)x

(t + 2)xy + x + y .

x2 + y2 = x+ y + txy + dx2y2 to

v2 � (t + 2)uv + dv =

(u2 � d)(u� (t + 2)):

u = (dxy + t + 2)=(x + y);

v =((t + 2)2 � d)x

(t + 2)xy + x + y .

x2 + y2 = x+ y + txy + dx2y2 to

v2 � (t + 2)uv + dv =

(u2 � d)(u� (t + 2)):

u = (dxy + t + 2)=(x + y);

v =((t + 2)2 � d)x

(t + 2)xy + x + y .

Completeness

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

Can denominators be 0?

x2 + y2 = x+ y + txy + dx2y2 to

v2 � (t + 2)uv + dv =

(u2 � d)(u� (t + 2)):

u = (dxy + t + 2)=(x + y);

v =((t + 2)2 � d)x

(t + 2)xy + x + y .

Completeness

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

x2 + y2 = x+ y + txy + dx2y2 to

v2 � (t + 2)uv + dv =

(u2 � d)(u� (t + 2)):

u = (dxy + t + 2)=(x + y);

v =((t + 2)2 � d)x

(t + 2)xy + x + y .

Completeness

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

x2 + y2 = x+ y + txy + dx2y2 to

v2 � (t + 2)uv + dv =

(u2 � d)(u� (t + 2)):

u = (dxy + t + 2)=(x + y);

v =((t + 2)2 � d)x

(t + 2)xy + x + y .

Completeness

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

x2 + y2 = x+ y + txy + dx2y2 to

v2 � (t + 2)uv + dv =

(u2 � d)(u� (t + 2)):

u = (dxy + t + 2)=(x + y);

v =((t + 2)2 � d)x

(t + 2)xy + x + y .

Completeness

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

Only if d is a square!

Theorem: Assume that

k is a field with 2 6= 0;

d; t; x1; y1; x2; y2 2 k;

d is not a square in k;

27d 6= (2� t)3;x2

1 +y21 = x1 +y1 +tx1y1 +dx2

1y21 ;

x22 +y2

2 = x2 +y2 +tx2y2 +dx22y2

2 .

Then 1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) 6= 0.

x2 + y2 = x+ y + txy + dx2y2 to

v2 � (t + 2)uv + dv =

(u2 � d)(u� (t + 2)):

u = (dxy + t + 2)=(x + y);

v =((t + 2)2 � d)x

(t + 2)xy + x + y .

Completeness

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

d; t; x1; y1; x2; y2 2 k;

27d 6= (2� t)3;x2

1 +y21 = x1 +y1 +tx1y1 +dx2

1y21 ;

x22 +y2

2 = x2 +y2 +tx2y2 +dx22y2

2 .

1(x2 + y2 + (t� 2)x2y2) 6= 0.

x2 + y2 = x+ y + txy + dx2y2 to

v2 � (t + 2)uv + dv =

(u2 � d)(u� (t + 2)):

u = (dxy + t + 2)=(x + y);

v =((t + 2)2 � d)x

(t + 2)xy + x + y .

Completeness

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

d; t; x1; y1; x2; y2 2 k;

27d 6= (2� t)3;x2

1 +y21 = x1 +y1 +tx1y1 +dx2

1y21 ;

x22 +y2

2 = x2 +y2 +tx2y2 +dx22y2

2 .

1(x2 + y2 + (t� 2)x2y2) 6= 0.

Completeness

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

d; t; x1; y1; x2; y2 2 k;

27d 6= (2� t)3;x2

1 +y21 = x1 +y1 +tx1y1 +dx2

1y21 ;

x22 +y2

2 = x2 +y2 +tx2y2 +dx22y2

2 .

1(x2 + y2 + (t� 2)x2y2) 6= 0.

Completeness

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

d; t; x1; y1; x2; y2 2 k;

27d 6= (2� t)3;x2

1 +y21 = x1 +y1 +tx1y1 +dx2

1y21 ;

x22 +y2

2 = x2 +y2 +tx2y2 +dx22y2

2 .

1(x2 + y2 + (t� 2)x2y2) 6= 0.

By x$ y symmetry

also 1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2) 6= 0.

Completeness

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

d; t; x1; y1; x2; y2 2 k;

27d 6= (2� t)3;x2

1 +y21 = x1 +y1 +tx1y1 +dx2

1y21 ;

x22 +y2

2 = x2 +y2 +tx2y2 +dx22y2

2 .

1(x2 + y2 + (t� 2)x2y2) 6= 0.

By x$ y symmetry

1(y2 + x2 + (t� 2)y2x2) 6= 0.

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

Completeness

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

d; t; x1; y1; x2; y2 2 k;

27d 6= (2� t)3;x2

1 +y21 = x1 +y1 +tx1y1 +dx2

1y21 ;

x22 +y2

2 = x2 +y2 +tx2y2 +dx22y2

2 .

1(x2 + y2 + (t� 2)x2y2) 6= 0.

By x$ y symmetry

1(y2 + x2 + (t� 2)y2x2) 6= 0.

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

Completeness

x3 =

x1 + x2 + (t� 2)x1x2 +

(x1 � y1)(x2 � y2) +

dx21(x2y1 + x2y2 � y1y2)

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2)

;

y3 =

y1 + y2 + (t� 2)y1y2 +

(y1 � x1)(y2 � x2) +

dy21(y2x1 + y2x2 � x1x2)

1� 2dy1y2x2 �dy2

1(y2 + x2 + (t� 2)y2x2)

.

d; t; x1; y1; x2; y2 2 k;

27d 6= (2� t)3;x2

1 +y21 = x1 +y1 +tx1y1 +dx2

1y21 ;

x22 +y2

2 = x2 +y2 +tx2y2 +dx22y2

2 .

1(x2 + y2 + (t� 2)x2y2) 6= 0.

By x$ y symmetry

1(y2 + x2 + (t� 2)y2x2) 6= 0.

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

d; t; x1; y1; x2; y2 2 k;

27d 6= (2� t)3;x2

1 +y21 = x1 +y1 +tx1y1 +dx2

1y21 ;

x22 +y2

2 = x2 +y2 +tx2y2 +dx22y2

2 .

1(x2 + y2 + (t� 2)x2y2) 6= 0.

By x$ y symmetry

1(y2 + x2 + (t� 2)y2x2) 6= 0.

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

d; t; x1; y1; x2; y2 2 k;

27d 6= (2� t)3;x2

1 +y21 = x1 +y1 +tx1y1 +dx2

1y21 ;

x22 +y2

2 = x2 +y2 +tx2y2 +dx22y2

2 .

1(x2 + y2 + (t� 2)x2y2) 6= 0.

By x$ y symmetry

1(y2 + x2 + (t� 2)y2x2) 6= 0.

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

Note that x1 6= 0.

d; t; x1; y1; x2; y2 2 k;

27d 6= (2� t)3;x2

1 +y21 = x1 +y1 +tx1y1 +dx2

1y21 ;

x22 +y2

2 = x2 +y2 +tx2y2 +dx22y2

2 .

1(x2 + y2 + (t� 2)x2y2) 6= 0.

By x$ y symmetry

1(y2 + x2 + (t� 2)y2x2) 6= 0.

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

Note that x1 6= 0.

Use curve equation2 to see that

(1� dx1x2y2)2 = dx2

1(x2 � y2)2.

d; t; x1; y1; x2; y2 2 k;

27d 6= (2� t)3;x2

1 +y21 = x1 +y1 +tx1y1 +dx2

1y21 ;

x22 +y2

2 = x2 +y2 +tx2y2 +dx22y2

2 .

1(x2 + y2 + (t� 2)x2y2) 6= 0.

By x$ y symmetry

1(y2 + x2 + (t� 2)y2x2) 6= 0.

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

Note that x1 6= 0.

(1� dx1x2y2)2 = dx2

1(x2 � y2)2.

By hypothesis d is non-square

so x21(x2 � y2)

2 = 0

and (1� dx1x2y2)2 = 0.

d; t; x1; y1; x2; y2 2 k;

27d 6= (2� t)3;x2

1 +y21 = x1 +y1 +tx1y1 +dx2

1y21 ;

x22 +y2

2 = x2 +y2 +tx2y2 +dx22y2

2 .

1(x2 + y2 + (t� 2)x2y2) 6= 0.

By x$ y symmetry

1(y2 + x2 + (t� 2)y2x2) 6= 0.

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

Note that x1 6= 0.

(1� dx1x2y2)2 = dx2

1(x2 � y2)2.

so x21(x2 � y2)

2 = 0

and (1� dx1x2y2)2 = 0.

Hence x2 = y2 and 1 = dx1x2y2.

d; t; x1; y1; x2; y2 2 k;

27d 6= (2� t)3;x2

1 +y21 = x1 +y1 +tx1y1 +dx2

1y21 ;

x22 +y2

2 = x2 +y2 +tx2y2 +dx22y2

2 .

1(x2 + y2 + (t� 2)x2y2) 6= 0.

By x$ y symmetry

1(y2 + x2 + (t� 2)y2x2) 6= 0.

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

Note that x1 6= 0.

(1� dx1x2y2)2 = dx2

1(x2 � y2)2.

so x21(x2 � y2)

2 = 0

and (1� dx1x2y2)2 = 0.

Curve equation1 times 1=x21:

1 + y21=x2

1 =

1=x1 + y1(1=x21 + t=x1) + dy2

1 .

d; t; x1; y1; x2; y2 2 k;

27d 6= (2� t)3;x2

1 +y21 = x1 +y1 +tx1y1 +dx2

1y21 ;

x22 +y2

2 = x2 +y2 +tx2y2 +dx22y2

2 .

1(x2 + y2 + (t� 2)x2y2) 6= 0.

By x$ y symmetry

1(y2 + x2 + (t� 2)y2x2) 6= 0.

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

Note that x1 6= 0.

(1� dx1x2y2)2 = dx2

1(x2 � y2)2.

so x21(x2 � y2)

2 = 0

and (1� dx1x2y2)2 = 0.

1 + y21=x2

1 =

1=x1 + y1(1=x21 + t=x1) + dy2

1 .

d; t; x1; y1; x2; y2 2 k;

27d 6= (2� t)3;x2

1 +y21 = x1 +y1 +tx1y1 +dx2

1y21 ;

x22 +y2

2 = x2 +y2 +tx2y2 +dx22y2

2 .

1(x2 + y2 + (t� 2)x2y2) 6= 0.

By x$ y symmetry

1(y2 + x2 + (t� 2)y2x2) 6= 0.

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

Note that x1 6= 0.

(1� dx1x2y2)2 = dx2

1(x2 � y2)2.

so x21(x2 � y2)

2 = 0

and (1� dx1x2y2)2 = 0.

1 + y21=x2

1 =

1=x1 + y1(1=x21 + t=x1) + dy2

1 .

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

Note that x1 6= 0.

(1� dx1x2y2)2 = dx2

1(x2 � y2)2.

so x21(x2 � y2)

2 = 0

and (1� dx1x2y2)2 = 0.

1 + y21=x2

1 =

1=x1 + y1(1=x21 + t=x1) + dy2

1 .

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

Note that x1 6= 0.

(1� dx1x2y2)2 = dx2

1(x2 � y2)2.

so x21(x2 � y2)

2 = 0

and (1� dx1x2y2)2 = 0.

1 + y21=x2

1 =

1=x1 + y1(1=x21 + t=x1) + dy2

1 .

Substitute 1=x1 = dx22:

1 + d2y21x4

2 =

dx22 + dy1(dx4

2 + x22t) + dy2

1 .

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

Note that x1 6= 0.

(1� dx1x2y2)2 = dx2

1(x2 � y2)2.

so x21(x2 � y2)

2 = 0

and (1� dx1x2y2)2 = 0.

1 + y21=x2

1 =

1=x1 + y1(1=x21 + t=x1) + dy2

1 .

1 + d2y21x4

2 =

dx22 + dy1(dx4

2 + x22t) + dy2

1 .

Substitute 2x22 = 2x2 + tx2

2 + dx42:

(1� dy1x22)

2 = d(x2 � y1)2.

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

Note that x1 6= 0.

(1� dx1x2y2)2 = dx2

1(x2 � y2)2.

so x21(x2 � y2)

2 = 0

and (1� dx1x2y2)2 = 0.

1 + y21=x2

1 =

1=x1 + y1(1=x21 + t=x1) + dy2

1 .

1 + d2y21x4

2 =

dx22 + dy1(dx4

2 + x22t) + dy2

1 .

2 + dx42:

(1� dy1x22)

2 = d(x2 � y1)2.

Thus x2 = y1 and 1 = dy1x22.

Hence 1 = dx32.

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

Note that x1 6= 0.

(1� dx1x2y2)2 = dx2

1(x2 � y2)2.

so x21(x2 � y2)

2 = 0

and (1� dx1x2y2)2 = 0.

1 + y21=x2

1 =

1=x1 + y1(1=x21 + t=x1) + dy2

1 .

1 + d2y21x4

2 =

dx22 + dy1(dx4

2 + x22t) + dy2

1 .

2 + dx42:

(1� dy1x22)

2 = d(x2 � y1)2.

Hence 1 = dx32.

Now 2x22 = 2x2 + tx2

2 + x2

so 3 = (2�t)x2 so 27d = (2�t)3.Contradiction.

Proof: Suppose that

1� 2dx1x2y2 �dx2

1(x2 + y2 + (t� 2)x2y2) = 0.

Note that x1 6= 0.

(1� dx1x2y2)2 = dx2

1(x2 � y2)2.

so x21(x2 � y2)

2 = 0

and (1� dx1x2y2)2 = 0.

1 + y21=x2

1 =

1=x1 + y1(1=x21 + t=x1) + dy2

1 .

1 + d2y21x4

2 =

dx22 + dy1(dx4

2 + x22t) + dy2

1 .

2 + dx42:

(1� dy1x22)

2 = d(x2 � y1)2.

Hence 1 = dx32.

Now 2x22 = 2x2 + tx2

2 + x2

What’s next?

Make the mathematicians happy:

Prove that all curves

are covered; should be easy

using Weil and rational param.

Make the computer happy:

Find faster complete laws.

Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj...

Documents

Transcript of Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj...